---
id: CVE-2026-114408
title: >-
  NULL pointer dereference in ICMPv6 Packet Too Big processing when the
  destination table is full
summary: >-
  In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built
  with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the
  destination-table entry it adds without checking that the add succeeded. A
  sender on …
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-252
  - CWE-476
vendor: Eclipse Foundation
product: Eclipse ThreadX NetX Duo
affected:
  - eclipse_threadx_netx_duo >= 6.4.5.202504 <= 6.5.2.202603a
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T16:18:37.472445Z'
published: '2026-11-02'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T13:32:15.724Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114408'
references:
  - url: >-
      https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-xjgr-2wmf-f78j
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/482'
tags:
  - cve.org
epss: 0.00364
epssPercentile: 0.30375
ingestedAt: '2026-11-05T20:33:06.733Z'
---

## Overview

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.

## Affected

- `eclipse_threadx_netx_duo >= 6.4.5.202504 <= 6.5.2.202603a`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.